Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-53876

Publication date:

15/12/2025

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2023-53879

Publication date:

15/12/2025

NVClient 5.0 contains a stack buffer overflow vulnerability in the user configuration contact field that allows attackers to crash the application. Attackers can overwrite 846 bytes of memory by pasting a crafted payload into the contact box, causing a denial of service condition.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2023-53869

Publication date:

15/12/2025

WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media function. Attackers can leverage any created account to upload malicious PHP scripts that enable remote code execution on the application server.

Severity CVSS v4.0: HIGH

Last modification:

15/12/2025

CVE-2023-53870

Publication date:

15/12/2025

Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2023-53871

Publication date:

15/12/2025

Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2023-53872

Publication date:

15/12/2025

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the &#39;numara&#39; parameter by appending shell commands with &#39;&&#39; operators to execute malicious code.

Severity CVSS v4.0: CRITICAL

Last modification:

15/12/2025

CVE-2023-53873

Publication date:

15/12/2025

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated &#39;password=&#39; values to overwhelm the login endpoint and potentially disrupt service availability.

Severity CVSS v4.0: HIGH

Last modification:

15/12/2025

CVE-2023-53868

Publication date:

15/12/2025

Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code by accessing the uploaded plugin script.

Severity CVSS v4.0: HIGH

Last modification:

15/12/2025

CVE-2023-53874

Publication date:

15/12/2025

GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attackers can overwrite the preset name with 260 &#39;A&#39; characters to trigger a buffer overflow and cause application instability.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2023-36338

Publication date:

15/12/2025

Inventory Management System 1 was discovered to contain a SQL injection vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2025

CVE-2023-38913

Publication date:

15/12/2025

SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2025

CVE-2025-67809

Publication date:

15/12/2025

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet used by Zimbra Collaboration. Because these credentials are embedded directly in the Zimlet, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access to the exposed credentials could impersonate the legitimate application and initiate valid Flickr OAuth flows. If a user is tricked into approving such a request, the attacker could gain access to the user s Flickr data. The hardcoded credentials have since been removed from the Zimlet code, and the associated key has been revoked.

Severity CVSS v4.0: Pending analysis

Last modification:

15/12/2025

Subscribe to Vulnerabilities